<!DOCTYPE HTML>
<html>
	<head>
		<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
		<title>Highcharts Example</title>

		<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js"></script>
		<script type="text/javascript">
$(function () {
        $('#container').highcharts({
            chart: {
                type: 'column'
            },
            title: {
                text: 'Attack Campaign Similarity'
            },
            subtitle: {
                text: 'Source: RATS'
            },
            xAxis: {
                categories: [
                    'Host',
                    'Ip Location',
                    'Network File',
                    'Threat Name',
                    'API',
                    'Detection',
                    'Detection/Exact'
                ]
            },
            yAxis: {
                min: 0,
                title: {
                    text: 'No of Similarity'
                }
            },
            tooltip: {
                headerFormat: '<span style="font-size:10px">{point.key}</span><table>',
                pointFormat: '<tr><td style="color:{series.color};padding:0">{series.name}: </td>' +
                    '<td style="padding:0"><b>{point.y:.1f} mm</b></td></tr>',
                footerFormat: '</table>',
                shared: true,
                useHTML: true
            },
            plotOptions: {
                column: {
                    pointPadding: 0.2,
                    borderWidth: 0
                }
            },
            series: [{
                name: 'Similarity',
                data: [49.9, 71.5, 106.4, 129.2, 144.0, 176.0, 135.6]
    
            }, {
                name: 'Set A',
                data: [83.6, 78.8, 98.5, 93.4, 106.0, 84.5, 105.0]
    
            }, {
                name: 'Set B',
                data: [48.9, 38.8, 39.3, 41.4, 47.0, 48.3, 59.0]
    
            }]
        });
    });
    

		</script>
	</head>
	<body>
<script src="../../js/highcharts.js"></script>
<script src="../../js/modules/exporting.js"></script>

<div id="container" style="min-width: 310px; height: 400px; margin: 0 auto"></div>

	</body>
</html>

<!DOCTYPE html><html lang="en"><head><link rel="stylesheet" href="style.css" /><title>ASDS</title></head><body><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="130">
 <TR>
  <TH bgcolor="#78b5ff"><a name="Summary"></a>Summary</TH>
  <TH bgcolor="#78b5ff">Result</TH>
 </TR>
 <TR>
  <TD><a href="#Host">Host</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="270">
  <COL width="80">
 <TR>
  <TD>Host Similarity</TD>
  <TD>2</TD>
 </TR>
 <TR>
  <TD>Host in set A</TD>
  <TD>49</TD>
 </TR>
 <TR>
  <TD>Host in set B</TD>
  <TD>19</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="#IP Location">IP Location</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="270">
  <COL width="80">
 <TR>
  <TD>IP Location Similarity</TD>
  <TD>1</TD>
 </TR>
 <TR>
  <TD>IP Location in set A</TD>
  <TD>3</TD>
 </TR>
 <TR>
  <TD>IP Location in set B</TD>
  <TD>4</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="#Network Files">Network Files</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="270">
  <COL width="80">
 <TR>
  <TD>Network Files Similarity</TD>
  <TD>1</TD>
 </TR>
 <TR>
  <TD>Network Files in set A</TD>
  <TD>3</TD>
 </TR>
 <TR>
  <TD>Network Files in set B</TD>
  <TD>12</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="#Threat Name">Threat Name</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="270">
  <COL width="80">
 <TR>
  <TD>Threat Names Similarity</TD>
  <TD>13</TD>
 </TR>
 <TR>
  <TD>Threat Names in set A</TD>
  <TD>29</TD>
 </TR>
 <TR>
  <TD>Threat Names in set B</TD>
  <TD>21</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="#Trait">Trait</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="270">
  <COL width="80">
 <TR>
  <TD>Trait Similarity</TD>
  <TD>120</TD>
 </TR>
 <TR>
  <TD>Trait in set A</TD>
  <TD>415</TD>
 </TR>
 <TR>
  <TD>Trait in set B</TD>
  <TD>356</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="#Trait Objects">Trait Objects</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="270">
  <COL width="80">
 <TR>
  <TD><a href="#API">API</a> Similarity</TD>
  <TD>2</TD>
 </TR>
 <TR>
  <TD><a href="#Detection">Detection</a> Similarity</TD>
  <TD>2</TD>
 </TR>
 <TR>
  <TD><a href="#Detection/Exact">Detection/Exact</a> Similarity</TD>
  <TD>15</TD>
 </TR>
 <TR>
  <TD><a href="#File">File</a> Similarity</TD>
  <TD>22</TD>
 </TR>
 <TR>
  <TD><a href="#Mutex">Mutex</a> Similarity</TD>
  <TD>1</TD>
 </TR>
 <TR>
  <TD><a href="#Network">Network</a> Similarity</TD>
  <TD>11</TD>
 </TR>
 <TR>
  <TD><a href="#Network/HTTP">Network/HTTP</a> Similarity</TD>
  <TD>1</TD>
 </TR>
 <TR>
  <TD><a href="#Registry/Value">Registry/Value</a> Similarity</TD>
  <TD>32</TD>
 </TR>
 <TR>
  <TD><a href="#Static">Static</a> Similarity</TD>
  <TD>3</TD>
 </TR>
 <TR>
  <TD><a href="#String">String</a> Similarity</TD>
  <TD>18</TD>
 </TR>
 <TR>
  <TD><a href="#Version">Version</a> Similarity</TD>
  <TD>12</TD>
 </TR>
 <TR>
  <TD><a href="#Window">Window</a> Similarity</TD>
  <TD>1</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="150">
  <COL width="320">
  <COL width="320">
 <TR>
  <TH bgcolor="#78b5ff"><a name="Threat Name"></a>Threat Name</TH>
  <TH bgcolor="#78b5ff">Set A</TH>
  <TH bgcolor="#78b5ff">Set B</TH>
 </TR>
 <TR>
  <TD>Backdoor.Breut</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2932924b4c4c00284db0bd52c12498d9">2932924b4c4c00284db0bd52c12498d9</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d61767442a900a49c24aa91b8d7ea56c">d61767442a900a49c24aa91b8d7ea56c</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/036fa9bd238a42f226db79ea5a9c8a4f">036fa9bd238a42f226db79ea5a9c8a4f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>CCUI/Trojan.Gen.3</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e2945a07252b2574881cf3111e37e043">e2945a07252b2574881cf3111e37e043</a></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/036fa9bd238a42f226db79ea5a9c8a4f">036fa9bd238a42f226db79ea5a9c8a4f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e2945a07252b2574881cf3111e37e043">e2945a07252b2574881cf3111e37e043</a></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>Clean</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e2945a07252b2574881cf3111e37e043">e2945a07252b2574881cf3111e37e043</a></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/036fa9bd238a42f226db79ea5a9c8a4f">036fa9bd238a42f226db79ea5a9c8a4f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e2945a07252b2574881cf3111e37e043">e2945a07252b2574881cf3111e37e043</a></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>Infostealer</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2932924b4c4c00284db0bd52c12498d9">2932924b4c4c00284db0bd52c12498d9</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d61767442a900a49c24aa91b8d7ea56c">d61767442a900a49c24aa91b8d7ea56c</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/036fa9bd238a42f226db79ea5a9c8a4f">036fa9bd238a42f226db79ea5a9c8a4f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>Infostealer.Limitail</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2932924b4c4c00284db0bd52c12498d9">2932924b4c4c00284db0bd52c12498d9</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d61767442a900a49c24aa91b8d7ea56c">d61767442a900a49c24aa91b8d7ea56c</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/036fa9bd238a42f226db79ea5a9c8a4f">036fa9bd238a42f226db79ea5a9c8a4f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>Not Malicious</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e2945a07252b2574881cf3111e37e043">e2945a07252b2574881cf3111e37e043</a></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/036fa9bd238a42f226db79ea5a9c8a4f">036fa9bd238a42f226db79ea5a9c8a4f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e2945a07252b2574881cf3111e37e043">e2945a07252b2574881cf3111e37e043</a></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>Threat Artifact</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e2945a07252b2574881cf3111e37e043">e2945a07252b2574881cf3111e37e043</a></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e2945a07252b2574881cf3111e37e043">e2945a07252b2574881cf3111e37e043</a></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>Trojan Horse</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2932924b4c4c00284db0bd52c12498d9">2932924b4c4c00284db0bd52c12498d9</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d61767442a900a49c24aa91b8d7ea56c">d61767442a900a49c24aa91b8d7ea56c</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/036fa9bd238a42f226db79ea5a9c8a4f">036fa9bd238a42f226db79ea5a9c8a4f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>Trojan.ADH.2</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>Trojan.Dropper</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2932924b4c4c00284db0bd52c12498d9">2932924b4c4c00284db0bd52c12498d9</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>Trojan.Gen</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2932924b4c4c00284db0bd52c12498d9">2932924b4c4c00284db0bd52c12498d9</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d61767442a900a49c24aa91b8d7ea56c">d61767442a900a49c24aa91b8d7ea56c</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/036fa9bd238a42f226db79ea5a9c8a4f">036fa9bd238a42f226db79ea5a9c8a4f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>Trojan.Maljava</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e2945a07252b2574881cf3111e37e043">e2945a07252b2574881cf3111e37e043</a></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e2945a07252b2574881cf3111e37e043">e2945a07252b2574881cf3111e37e043</a></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>Trojan.Zbot</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2932924b4c4c00284db0bd52c12498d9">2932924b4c4c00284db0bd52c12498d9</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d61767442a900a49c24aa91b8d7ea56c">d61767442a900a49c24aa91b8d7ea56c</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="320">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/036fa9bd238a42f226db79ea5a9c8a4f">036fa9bd238a42f226db79ea5a9c8a4f</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="150">
  <COL width="350">
  <COL width="350">
 <TR>
  <TH bgcolor="#78b5ff"><a name="Host"></a>Host</TH>
  <TH bgcolor="#78b5ff">Set A</TH>
  <TH bgcolor="#78b5ff">Set B</TH>
 </TR>
 <TR>
  <TD>angels-deamon.us</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="100">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="100">
 <TR>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>Connect</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="100">
 <TR>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>Connect</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="100">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="100">
 <TR>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>Connect</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="100">
 <TR>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>Connect</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>reserve-citadelhost.%NETWORKDOMAIN%</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="100">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="100">
 <TR>
  <TD>Search</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="100">
 <TR>
  <TD>Search</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="100">
 <TR>
  <TD>Search</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="100">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="100">
 <TR>
  <TD>Search</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="100">
 <TR>
  <TD>Search</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="100">
 <TR>
  <TD>Search</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="100">
 <TR>
  <TD>Search</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="150">
  <COL width="350">
  <COL width="350">
 <TR>
  <TH bgcolor="#78b5ff"><a name="IP Location"></a>IP Location</TH>
  <TH bgcolor="#78b5ff">Set A</TH>
  <TH bgcolor="#78b5ff">Set B</TH>
 </TR>
 <TR>
  <TD>America/Los_Angeles</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="100">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="100">
 <TR>
  <TD>209.85.143.99</TD>
 </TR>
 <TR>
  <TD>107.6.39.172</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="100">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="100">
 <TR>
  <TD>74.91.118.239</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="150">
  <COL width="600">
  <COL width="600">
 <TR>
  <TH bgcolor="#78b5ff"><a name="Network Files"></a>Network Files</TH>
  <TH bgcolor="#78b5ff">Set A</TH>
  <TH bgcolor="#78b5ff">Set B</TH>
 </TR>
 <TR>
  <TD>file.php</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="400">
 <TR>
  <TD>http://angels-deamon.us/milky/file.php</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="400">
 <TR>
  <TD>http://angels-deamon.us/mique/file.php</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="400">
 <TR>
  <TD>http://www.merchantspeedcourier.com/wordpress/wp-includes/images/india/file.php</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="400">
 <TR>
  <TD>http://angels-deamon.us/mique/file.php</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="400">
 <TR>
  <TD>http://poliviskon.com/js/pal/helps/file.php</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="400">
 <TR>
  <TD>http://angels-deamon.us/mique/file.php</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="400">
 <TR>
  <TD>http://tekstureiplik.com/js/idk/helps/file.php</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="400">
 <TR>
  <TD>http://actaver.com/ken/file.php</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a name="Trait"></a><a name="Trait Objects"></a><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="1850">
 <TR>
  <TH bgcolor="#78b5ff"><a name="Version"></a>Version</TH>
 </TR>
 <TR>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="50">
  <COL width="100">
  <COL width="800">
  <COL width="800">
 <TR>
  <TD>No</TD>
  <TD>Match %</TD>
  <TD>Set A</TD>
  <TD>Set B</TD>
 </TR>
 <TR>
  <TD>1</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>The UPX Team http://upx.sf.net </TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Publisher</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>The UPX Team http://upx.sf.net </TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Publisher</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>The UPX Team http://upx.sf.net </TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Publisher</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>2</TD>
  <TD>11</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Hold Mor</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Description</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HD Player                                                </TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Product</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>3</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Looey's r?ntge</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Description</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Looey's r?ntge</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Description</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>4</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Nonm</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Internal name</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Nonm</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Internal name</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>5</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Fumishin periostr</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Product</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Fumishin periostr</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Product</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>6</TD>
  <TD>11</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Hold Mor</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Description</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HD Player                         </TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Description</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>7</TD>
  <TD>15</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>1, 0, 0, 1</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Version</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>1.09.0007</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Version</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>8</TD>
  <TD>10</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>onceMa.exe</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Internal name</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Venetia neuma</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Product</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>9</TD>
  <TD>15</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>1, 0, 0, 1</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Version</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>1.07.0002</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Version</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>10</TD>
  <TD>14</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>nachstehenden</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Internal name</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Wealden</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Internal name</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>11</TD>
  <TD>11</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Looey's r?ntge</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Description</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>lont</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Product</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>12</TD>
  <TD>27</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Copyright (C) 1999</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Copyright</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/036fa9bd238a42f226db79ea5a9c8a4f">036fa9bd238a42f226db79ea5a9c8a4f</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Copyright (c) BlueStack Systems Inc.</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Copyright</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Version</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="1850">
 <TR>
  <TH bgcolor="#78b5ff"><a name="Network"></a>Network</TH>
 </TR>
 <TR>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="50">
  <COL width="100">
  <COL width="800">
  <COL width="800">
 <TR>
  <TD>No</TD>
  <TD>Match %</TD>
  <TD>Set A</TD>
  <TD>Set B</TD>
 </TR>
 <TR>
  <TD>1</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>angels-deamon.us</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>angels-deamon.us</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>angels-deamon.us</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>angels-deamon.us</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>2</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>80</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Port</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>80</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Port</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>80</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Port</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/6c713056fcaac0faac7fc14ad4b873df">6c713056fcaac0faac7fc14ad4b873df</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>80</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Port</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>80</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Port</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>3</TD>
  <TD>12</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>cdn1.down.17173ie.com</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>cdn1.airdlrstatic.com</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>4</TD>
  <TD>12</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>107.6.39.172</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>12182</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>ASN</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>5</TD>
  <TD>18</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2932924b4c4c00284db0bd52c12498d9">2932924b4c4c00284db0bd52c12498d9</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>domain=carrotpizzaeater.me.uk, server=uk.whois-servers.net, registrar=Internet.bs Corp. t/a Internet.bs Corp. [Tag = INTERNET-BS], registrant=Yoji Majimuro, created=06-May-2014, updated=06-May-2014, expires=06-May-2015, status=Registered until expiry date.</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Whois</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>domain=fundepalma.org, server=org.whois-servers.net, registrar=eNom, Inc. (R39-LROR), registrant=Registro Dominios, email=sborlando@hotmail.com, created=12-Dec-2009 14:07:31 UTC, updated=07-Dec-2011 19:05:40 UTC, expires=12-Dec-2012 14:07:31 UTC, status=CLIENT TRANSFER PROHIBITED</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Whois</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>6</TD>
  <TD>20</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>domain=google.com, server=whois.markmonitor.com, registrar=Markmonitor.com, registrant=Dns Admin, created=1997-09-15, updated=2011-07-20, expires=2020-09-13</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Whois</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>domain=aintnogossip.com, server=whois.godaddy.com, registrar=GoDaddy.com, LLC (http://www.godaddy.com), registrant=aintnogossip</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Whois</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>7</TD>
  <TD>15</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>mname=ns1.google.com, rname=dns-admin.google.com</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>DNS</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>mname=ns1.tsm-international.fr, rname=blozynsky.e-tecpowerman.com</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>DNS</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>8</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>reserve-citadelhost.%NETWORKDOMAIN%</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>reserve-citadelhost.%NETWORKDOMAIN%</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>reserve-citadelhost.%NETWORKDOMAIN%</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>reserve-citadelhost.%NETWORKDOMAIN%</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>reserve-citadelhost.%NETWORKDOMAIN%</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>reserve-citadelhost.%NETWORKDOMAIN%</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>reserve-citadelhost.%NETWORKDOMAIN%</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Search</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>9</TD>
  <TD>25</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>mname=ns1.google.com, rname=dns-admin.google.com</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>DNS</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>mname=ns51.domaincontrol.com, rname=dns.jomax.net</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>DNS</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>10</TD>
  <TD>34</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2932924b4c4c00284db0bd52c12498d9">2932924b4c4c00284db0bd52c12498d9</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>domain=carrotpizzaeater.me.uk, server=uk.whois-servers.net, registrar=Internet.bs Corp. t/a Internet.bs Corp. [Tag = INTERNET-BS], registrant=Yoji Majimuro, created=06-May-2014, updated=06-May-2014, expires=06-May-2015, status=Registered until expiry date.</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Whois</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>domain=e-tecinnovation.co.uk, server=uk.whois-servers.net, registrar=PDR Ltd. d/b/a PublicDomainRegistry.com [Tag = PDR-IN], registrant=E-TEC Power International Ltd, created=16-Aug-2011, updated=06-Nov-2012, expires=16-Aug-2013, status=Registered until expiry date.</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Whois</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>11</TD>
  <TD>21</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>mname=ns1.google.com, rname=dns-admin.google.com</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>DNS</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>mname=dns1.name-services.com, rname=info.name-services.com</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>DNS</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="1850">
 <TR>
  <TH bgcolor="#78b5ff"><a name="Detection/Exact"></a>Detection/Exact</TH>
 </TR>
 <TR>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="50">
  <COL width="100">
  <COL width="800">
  <COL width="800">
 <TR>
  <TD>No</TD>
  <TD>Match %</TD>
  <TD>Set A</TD>
  <TD>Set B</TD>
 </TR>
 <TR>
  <TD>1</TD>
  <TD>20</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Trojan.MulDrop.origin</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>DrWeb</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Trojan.Inject2</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>IKARUS</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>2</TD>
  <TD>19</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32:Zbot-TYO</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Avast</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/6c713056fcaac0faac7fc14ad4b873df">6c713056fcaac0faac7fc14ad4b873df</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32.SuspectCrc</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>IKARUS</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32.SuspectCrc</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>IKARUS</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>3</TD>
  <TD>16</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32:Zbot-TYO</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Avast</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32/AirAdInstaller.A</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Eset</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>4</TD>
  <TD>31</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Trojan.Win32.Reconyc.bpbe</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Kaspersky</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Trojan.Win32.Buzus.oogm</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Kaspersky</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>5</TD>
  <TD>17</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32:Zbot-TYO</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Avast</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32/Injector.BCWJ</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Eset</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>6</TD>
  <TD>56</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32:Zbot-TYO</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Avast</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32/Zbot</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>mpscanp</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>7</TD>
  <TD>21</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32:Malware-gen</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Avast</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/6c713056fcaac0faac7fc14ad4b873df">6c713056fcaac0faac7fc14ad4b873df</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32/AdWare.Kraddare.IL</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Eset</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>8</TD>
  <TD>23</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32/Malex.gen!E</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>mpscanp</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32:Agent-ATPQ</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Avast</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>9</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Generic Malware</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Panda</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Generic Malware</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Panda</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>10</TD>
  <TD>15</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Trojan.MulDrop.origin</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>DrWeb</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Trojan.GenericKD.1668687</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>SoftwinBDC</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>11</TD>
  <TD>17</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32:Zbot-TYO</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Avast</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32/Injector.BEDD</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Eset</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>12</TD>
  <TD>15</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Mal/Keylog-Z</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Sophos</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Mal/VB-ALO</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Sophos</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Mal/VB-ALO</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Sophos</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Mal/VB-ALO</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Sophos</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Mal/VB-ALO</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Sophos</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Mal/VB-ALO</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Sophos</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>13</TD>
  <TD>60</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Trojan-Spy.Win32.Zbot.tcfy</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Kaspersky</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Trojan-Spy.Win32.Zbot.shmw</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Kaspersky</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>14</TD>
  <TD>33</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Trojan.Win32.Reconyc.bpbe</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Kaspersky</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Trojan.Win32.VBKrypt</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>IKARUS</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>15</TD>
  <TD>14</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>Win32/Malex.gen!E</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>mpscanp</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>winpe/Troj_Generic.TWBOR</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>NCMD</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Detection/Exact</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="1850">
 <TR>
  <TH bgcolor="#78b5ff"><a name="Registry/Value"></a>Registry/Value</TH>
 </TR>
 <TR>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="50">
  <COL width="100">
  <COL width="800">
  <COL width="800">
 <TR>
  <TD>No</TD>
  <TD>Match %</TD>
  <TD>Set A</TD>
  <TD>Set B</TD>
 </TR>
 <TR>
  <TD>1</TD>
  <TD>10</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 50 00 6f 00 77 00...</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>2</TD>
  <TD>28</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>a8 27 29 10 a5 76 cf 01</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>8c 4b d0 15 a5 76 cf 01</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>3</TD>
  <TD>10</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 00 65 00 78 00 74 00 20 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00...</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>4</TD>
  <TD>20</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>a8 27 29 10 a5 76 cf 01</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>ea ab e9 50 06 76 cf 01</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>5</TD>
  <TD>10</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 65 00 64 00 20 00 28 00 7a 00...</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>6</TD>
  <TD>10</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 45 00 78 00 63 00...</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>7</TD>
  <TD>16</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\"Start Page"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew\"Language"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Delete</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>8</TD>
  <TD>10</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 41 00 63 00 63 00...</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>9</TD>
  <TD>20</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>a8 27 29 10 a5 76 cf 01</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>3a 16 1f 42 b1 76 cf 01</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>10</TD>
  <TD>41</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000002</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000002</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000002</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000409</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>11</TD>
  <TD>12</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>c6 36 ff e5 ab 73 cf 01</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>bc ea 9a 98 81 78 cf 01</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>12</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000002</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000002</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000002</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000002</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000002</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000002</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000002</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000002</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000002</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>13</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>14</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2932924b4c4c00284db0bd52c12498d9">2932924b4c4c00284db0bd52c12498d9</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000001</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000001</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000001</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d61767442a900a49c24aa91b8d7ea56c">d61767442a900a49c24aa91b8d7ea56c</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000001</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000001</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000001</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000001</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000001</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000001</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000001</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000001</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>15</TD>
  <TD>12</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>c6 36 ff e5 ab 73 cf 01</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>90 66 41 ee 92 7f cf 01</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>16</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Software\Microsoft\Outlook Express\5.0\"Compact Check Count"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Software\Microsoft\Outlook Express\5.0\"Compact Check Count"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Software\Microsoft\Outlook Express\5.0\"Compact Check Count"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Software\Microsoft\Outlook Express\5.0\"Compact Check Count"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Software\Microsoft\Outlook Express\5.0\"Compact Check Count"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Software\Microsoft\Outlook Express\5.0\"Compact Check Count"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Software\Microsoft\Outlook Express\5.0\"Compact Check Count"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Software\Microsoft\Outlook Express\5.0\"Compact Check Count"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Software\Microsoft\Outlook Express\5.0\"Compact Check Count"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>17</TD>
  <TD>12</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>c6 36 ff e5 ab 73 cf 01</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>e9 b3 3e 92 cd 7b cf 01</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>18</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UnreadMail\%USERNAME%@%NETWORKDOMAIN%\"TimeStamp"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UnreadMail\%USERNAME%@%NETWORKDOMAIN%\"TimeStamp"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UnreadMail\%USERNAME%@%NETWORKDOMAIN%\"TimeStamp"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UnreadMail\%USERNAME%@%NETWORKDOMAIN%\"TimeStamp"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UnreadMail\%USERNAME%@%NETWORKDOMAIN%\"TimeStamp"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UnreadMail\%USERNAME%@%NETWORKDOMAIN%\"TimeStamp"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UnreadMail\%USERNAME%@%NETWORKDOMAIN%\"TimeStamp"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UnreadMail\%USERNAME%@%NETWORKDOMAIN%\"TimeStamp"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UnreadMail\%USERNAME%@%NETWORKDOMAIN%\"TimeStamp"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>19</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\"ConnectionSettingsMigrated"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\"ConnectionSettingsMigrated"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\"ConnectionSettingsMigrated"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\"ConnectionSettingsMigrated"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\"ConnectionSettingsMigrated"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\"ConnectionSettingsMigrated"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\"ConnectionSettingsMigrated"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\"ConnectionSettingsMigrated"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\"ConnectionSettingsMigrated"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>20</TD>
  <TD>12</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3ab7afc3-c20c-11dd-b0f9-806d6172696f}\"Generation"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew\"Microsoft PowerPoint Presentation"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Delete</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>21</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\"1609"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\"1609"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d61767442a900a49c24aa91b8d7ea56c">d61767442a900a49c24aa91b8d7ea56c</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\"1609"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\"1609"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\"1609"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\"1609"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\"1609"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\"1609"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\"1609"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\"1609"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>22</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy\"CleanCookies"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy\"CleanCookies"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy\"CleanCookies"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy\"CleanCookies"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy\"CleanCookies"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy\"CleanCookies"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy\"CleanCookies"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy\"CleanCookies"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy\"CleanCookies"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>23</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\"1406"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\"1406"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\"1406"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\"1406"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\"1406"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\"1406"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\"1406"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\"1406"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\"1406"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>24</TD>
  <TD>10</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Software\Microsoft\Outlook Express\5.0\"Compact Check Count"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Software\Microsoft\Outlook Express\5.0\"Compact Check Count"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Software\Microsoft\Outlook Express\5.0\"Compact Check Count"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew\"Compressed (zipped) Folder"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Delete</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>25</TD>
  <TD>14</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000002</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000002</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000002</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>18 00 00 00 01 00 01 00 db 07 02 00 04 00 18 00 0f 00 0f 00 37 00 90 02</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>26</TD>
  <TD>14</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3ab7afc3-c20c-11dd-b0f9-806d6172696f}\"Generation"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew\"Microsoft Access Application"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Delete</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>27</TD>
  <TD>10</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 00 69 00 74 00 6d 00 61 00 70 00 20 00 49 00 6d 00 61 00 67 00 65 00 00 00...</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>28</TD>
  <TD>10</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 57 00 6f 00 72 00...</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>29</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\"FirstRun"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\"FirstRun"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\"FirstRun"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\"FirstRun"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\"FirstRun"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\"FirstRun"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\"FirstRun"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\"FirstRun"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\"FirstRun"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>30</TD>
  <TD>10</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>0x00000000</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 00 72 00 69 00 65 00 66 00 63 00 61 00 73 00 65 00 00 00 00 00 00 00 00 00...</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>31</TD>
  <TD>13</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>"\%USERAPPDATA%\Uqqe\ydyc.exe\"""</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Data</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Ciyl\"Yfasobofc"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>32</TD>
  <TD>14</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\"Start Page"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew\"Bitmap Image"</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Delete</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Registry/Value</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="1850">
 <TR>
  <TH bgcolor="#78b5ff"><a name="Detection"></a>Detection</TH>
 </TR>
 <TR>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="50">
  <COL width="100">
  <COL width="800">
  <COL width="800">
 <TR>
  <TD>No</TD>
  <TD>Match %</TD>
  <TD>Set A</TD>
  <TD>Set B</TD>
 </TR>
 <TR>
  <TD>1</TD>
  <TD>22</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Win32:Zbot-TY..</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Avast</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Detection</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Win32:Agent-AT..</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Avast</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Detection</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>2</TD>
  <TD>16</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Trojan-Spy.Win32.Zbot.qt..</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>kavcon</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Detection</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Trojan.GenericKD.166..</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>SoftwinBDC</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Detection</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="1850">
 <TR>
  <TH bgcolor="#78b5ff"><a name="Window"></a>Window</TH>
 </TR>
 <TR>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="50">
  <COL width="100">
  <COL width="800">
  <COL width="800">
 <TR>
  <TD>No</TD>
  <TD>Match %</TD>
  <TD>Set A</TD>
  <TD>Set B</TD>
 </TR>
 <TR>
  <TD>1</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>className=STATIC, wndName=ÁªÏµÔÚÏß¿Í·þ</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Window</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>className=Progman, wndName=Program Manager</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Window</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>className=ConsoleWindowClass, wndName=C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\GoogleUpdate.exe</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Window</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>className=TForm1, wndName=svchost</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Window</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>className=Afx:00400000:0, wndName=</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Window</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="1850">
 <TR>
  <TH bgcolor="#78b5ff"><a name="API"></a>API</TH>
 </TR>
 <TR>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="50">
  <COL width="100">
  <COL width="800">
  <COL width="800">
 <TR>
  <TD>No</TD>
  <TD>Match %</TD>
  <TD>Set A</TD>
  <TD>Set B</TD>
 </TR>
 <TR>
  <TD>1</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>api="SHGetFileInfo", process="%ORIGINALSAMPLENAME%"</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Context</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>API</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>api="DrvGetModuleHandle", process="%ORIGINALSAMPLENAME%"</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Context</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>API</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/6c713056fcaac0faac7fc14ad4b873df">6c713056fcaac0faac7fc14ad4b873df</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>api="ShellExecuteExA", process="%ORIGINALSAMPLENAME%"</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Context</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>API</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>api="Zombie_AddRef", process="oddo.exe"</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Context</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>API</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>api="Zombie_AddRef", process="moomz.exe"</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Context</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>API</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>2</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>?</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>SHGetFileInfo</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>API</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>?</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>DrvGetModuleHandle</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>API</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/6c713056fcaac0faac7fc14ad4b873df">6c713056fcaac0faac7fc14ad4b873df</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>?</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>ShellExecuteExA</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>API</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>?</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Zombie_AddRef</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>API</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>?</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Zombie_AddRef</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>API</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="1850">
 <TR>
  <TH bgcolor="#78b5ff"><a name="Mutex"></a>Mutex</TH>
 </TR>
 <TR>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="50">
  <COL width="100">
  <COL width="800">
  <COL width="800">
 <TR>
  <TD>No</TD>
  <TD>Match %</TD>
  <TD>Set A</TD>
  <TD>Set B</TD>
 </TR>
 <TR>
  <TD>1</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Global\{1F4F13EA-A493-2BEA-15FE-48B49DCC4EFF}</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Mutex</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Global\{1F4F13EA-A493-2BEA-15FE-48B49DCC4EFF}</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Mutex</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="1850">
 <TR>
  <TH bgcolor="#78b5ff"><a name="File"></a>File</TH>
 </TR>
 <TR>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="50">
  <COL width="100">
  <COL width="800">
  <COL width="800">
 <TR>
  <TD>No</TD>
  <TD>Match %</TD>
  <TD>Set A</TD>
  <TD>Set B</TD>
 </TR>
 <TR>
  <TD>1</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%WORKINGDIRECTORY%</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Rename</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/6c713056fcaac0faac7fc14ad4b873df">6c713056fcaac0faac7fc14ad4b873df</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%WORKINGDIRECTORY%</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>2</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>d41d8cd98f00b204e9800998ecf8427e</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>d41d8cd98f00b204e9800998ecf8427e</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>d41d8cd98f00b204e9800998ecf8427e</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>d41d8cd98f00b204e9800998ecf8427e</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>d41d8cd98f00b204e9800998ecf8427e</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>d41d8cd98f00b204e9800998ecf8427e</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>d41d8cd98f00b204e9800998ecf8427e</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>d41d8cd98f00b204e9800998ecf8427e</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>d41d8cd98f00b204e9800998ecf8427e</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>3</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%TEMP%\%HEXDIGITS%_appcompat.txt</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%TEMP%\%HEXDIGITS%_appcompat.txt</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%TEMP%\%HEXDIGITS%_appcompat.txt</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>4</TD>
  <TD>12</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Sent Items.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Sent Items.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Sent Items.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>%Temp%\setup.exe</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>5</TD>
  <TD>18</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Inbox.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Inbox.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Inbox.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Foutek\roox.geb</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>6</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Folders.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Folders.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Folders.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Folders.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Folders.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Folders.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Folders.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Folders.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Folders.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>7</TD>
  <TD>10</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%WORKINGDIRECTORY%\C\DOCUME~1\SIMONS~1\LOCALS~1\Temp\i.rar</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Rename</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Evusgi</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>8</TD>
  <TD>12</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Hozuo\izve.isg</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%TEMP%\N0YbSCdJA4\intro_page.html</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>9</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d61767442a900a49c24aa91b8d7ea56c">d61767442a900a49c24aa91b8d7ea56c</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Trojan.Shylock</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Scan Generic</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Trojan.FakeAV!gen32</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Scan Filtered</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>10</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>5c9871500ef4f120d08456c18e04bb8c</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>5c9871500ef4f120d08456c18e04bb8c</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>5c9871500ef4f120d08456c18e04bb8c</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>5c9871500ef4f120d08456c18e04bb8c</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>5c9871500ef4f120d08456c18e04bb8c</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>5c9871500ef4f120d08456c18e04bb8c</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>5c9871500ef4f120d08456c18e04bb8c</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>5c9871500ef4f120d08456c18e04bb8c</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>5c9871500ef4f120d08456c18e04bb8c</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>11</TD>
  <TD>12</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%WORKINGDIRECTORY%\C\DOCUME~1\SIMONS~1\LOCALS~1\Temp\i.rar</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Rename</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Ipdop\ixqo.noo</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>12</TD>
  <TD>11</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Sent Items.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Sent Items.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Sent Items.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%TEMP%\VyYYzy3p54\session.xml</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>13</TD>
  <TD>11</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%WORKINGDIRECTORY%\C\DOCUME~1\SIMONS~1\LOCALS~1\Temp\i.rar</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Rename</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Huih\iwefc.vyr</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>14</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Sent Items.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Sent Items.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Sent Items.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Sent Items.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Sent Items.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Sent Items.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Sent Items.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Sent Items.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Sent Items.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>15</TD>
  <TD>11</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%WORKINGDIRECTORY%\C\DOCUME~1\SIMONS~1\LOCALS~1\Temp\i.rar</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Rename</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Uznaix\lyhai.exe</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>16</TD>
  <TD>12</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%WORKINGDIRECTORY%\C\DOCUME~1\SIMONS~1\LOCALS~1\Temp\i.rar</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Rename</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Oxpaz\resi.tmp</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>17</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Inbox.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Inbox.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Inbox.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Inbox.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Inbox.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Inbox.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Inbox.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Inbox.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Inbox.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>18</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>ffffffffffffffffffffffffffffffff</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait2</TD>
  <TD>ffffffffffffffffffffffffffffffff</TD>
 </TR>
 <TR>
  <TD>trait2_action</TD>
  <TD>MD5</TD>
 </TR>
 <TR>
  <TD>trait2_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>19</TD>
  <TD>15</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%TEMP%\%HEXDIGITS%_appcompat.txt</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%TEMP%\%HEXDIGITS%_appcompat.txt</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%TEMP%\N0YbSCdJA4\theme\software\compat-2.png</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>20</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2932924b4c4c00284db0bd52c12498d9">2932924b4c4c00284db0bd52c12498d9</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>XPAntivirus</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Scan Filtered</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>XPAntivirus</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Scan Filtered</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>21</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Offline.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Offline.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Offline.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Offline.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Offline.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Offline.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Offline.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Offline.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Identities\{91FD83EF-B9F6-410E-97DC-5C667AC85868}\Microsoft\Outlook Express\Offline.dbx</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Modify</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>22</TD>
  <TD>11</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%WORKINGDIRECTORY%\C\DOCUME~1\SIMONS~1\LOCALS~1\Temp\i.rar</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Rename</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>%USERAPPDATA%\Negune\xecai.zue</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Create</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>File</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="1850">
 <TR>
  <TH bgcolor="#78b5ff"><a name="Static"></a>Static</TH>
 </TR>
 <TR>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="50">
  <COL width="100">
  <COL width="800">
  <COL width="800">
 <TR>
  <TD>No</TD>
  <TD>Match %</TD>
  <TD>Set A</TD>
  <TD>Set B</TD>
 </TR>
 <TR>
  <TD>1</TD>
  <TD>63</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE; Installer; Nullsoft</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/036fa9bd238a42f226db79ea5a9c8a4f">036fa9bd238a42f226db79ea5a9c8a4f</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE; Installer; 7zip</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>2</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e2945a07252b2574881cf3111e37e043">e2945a07252b2574881cf3111e37e043</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Zip archive data, at least v2.0 to extract</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>GNU File</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e2945a07252b2574881cf3111e37e043">e2945a07252b2574881cf3111e37e043</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Zip archive data, at least v2.0 to extract</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>GNU File</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>3</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2932924b4c4c00284db0bd52c12498d9">2932924b4c4c00284db0bd52c12498d9</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c69902d73901b3d3ba26909c1c0d1d51">c69902d73901b3d3ba26909c1c0d1d51</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d61767442a900a49c24aa91b8d7ea56c">d61767442a900a49c24aa91b8d7ea56c</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/10d4dbdfd14338617e0539ee84b22bf3">10d4dbdfd14338617e0539ee84b22bf3</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/6c713056fcaac0faac7fc14ad4b873df">6c713056fcaac0faac7fc14ad4b873df</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>PE - I386, Windows GUI, EXE</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>xfile</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Static</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="1850">
 <TR>
  <TH bgcolor="#78b5ff"><a name="Network/HTTP"></a>Network/HTTP</TH>
 </TR>
 <TR>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="50">
  <COL width="100">
  <COL width="800">
  <COL width="800">
 <TR>
  <TD>No</TD>
  <TD>Match %</TD>
  <TD>Set A</TD>
  <TD>Set B</TD>
 </TR>
 <TR>
  <TD>1</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>http://angels-deamon.us/milky/file.php</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Connect</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network/HTTP</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>http://angels-deamon.us/mique/file.php</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Connect</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network/HTTP</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d6faa56a231ca494a406dc8b2a94e21b">d6faa56a231ca494a406dc8b2a94e21b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>http://www.merchantspeedcourier.com/wordpress/wp-includes/images/india/file.php</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Connect</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network/HTTP</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>http://tekstureiplik.com/js/idk/helps/file.php</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Connect</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network/HTTP</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>http://actaver.com/ken/file.php</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Connect</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network/HTTP</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>http://angels-deamon.us/mique/file.php</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Connect</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network/HTTP</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>http://angels-deamon.us/mique/file.php</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Connect</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network/HTTP</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>http://poliviskon.com/js/pal/helps/file.php</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Connect</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>Network/HTTP</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br><a href="#Summary">Go to top</a><TABLE cellpadding="4" style="border: 1px solid #000000; border-collapse: collapse;" border="1">
  <COL width="1850">
 <TR>
  <TH bgcolor="#78b5ff"><a name="String"></a>String</TH>
 </TR>
 <TR>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="50">
  <COL width="100">
  <COL width="800">
  <COL width="800">
 <TR>
  <TD>No</TD>
  <TD>Match %</TD>
  <TD>Set A</TD>
  <TD>Set B</TD>
 </TR>
 <TR>
  <TD>1</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>MSVBVM60.DLL
4D535642564D36302E444C4C
ADD INFO: Probably a Visual Basic 6.0 application. Yuck!
CLASSIFICATION: Just information</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>MSVBVM60.DLL
4D535642564D36302E444C4C
ADD INFO: Probably a Visual Basic 6.0 application. Yuck!
CLASSIFICATION: Just information</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>MSVBVM60.DLL
4D535642564D36302E444C4C
ADD INFO: Probably a Visual Basic 6.0 application. Yuck!
CLASSIFICATION: Just information</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>MSVBVM60.DLL
4D535642564D36302E444C4C
ADD INFO: Probably a Visual Basic 6.0 application. Yuck!
CLASSIFICATION: Just information</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>MSVBVM60.DLL
4D535642564D36302E444C4C
ADD INFO: Probably a Visual Basic 6.0 application. Yuck!
CLASSIFICATION: Just information</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>MSVBVM60.DLL
4D535642564D36302E444C4C
ADD INFO: Probably a Visual Basic 6.0 application. Yuck!
CLASSIFICATION: Just information</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>MSVBVM60.DLL
4D535642564D36302E444C4C
ADD INFO: Probably a Visual Basic 6.0 application. Yuck!
CLASSIFICATION: Just information</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>2</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Symantec
53796D616E746563
ADD INFO: Symantec reference
CLASSIFICATION: Can be used for mal purpose</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Symantec
53796D616E746563
ADD INFO: Symantec reference
CLASSIFICATION: Can be used for mal purpose</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Symantec
53796D616E746563
ADD INFO: Symantec reference
CLASSIFICATION: Can be used for mal purpose</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Symantec
53796D616E746563
ADD INFO: Symantec reference
CLASSIFICATION: Can be used for mal purpose</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>3</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Possible COM Program</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/6c713056fcaac0faac7fc14ad4b873df">6c713056fcaac0faac7fc14ad4b873df</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Possible COM Program</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>4</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>SRS}NNN</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>SRS}NNN</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>SRS}NNN</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>SRS}NNN</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>5</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>q@@@H@@@C@</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>q@@@H@@@C@</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>q@@@H@@@C@</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>q@@@H@@@C@</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>6</TD>
  <TD>13</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>aaaaa  E</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/696d7f238fa1719f0abf28d34f6765c5">696d7f238fa1719f0abf28d34f6765c5</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>anamite</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>7</TD>
  <TD>18</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>__vbaDerefAry1</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>__vbaCyForInit</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>8</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/0a0ef0374b14f1b0212aeb3e28e764ca">0a0ef0374b14f1b0212aeb3e28e764ca</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>.9csm.u?.=???..t?h???..??.......t%..???.....%%.??...
813963736DE075??833D??????000074??68??????00E8????000083C40485C074%CfFF15??????0083C4088B%f%fE8????00008
VID: D16B Trojan.Shylock</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/6c713056fcaac0faac7fc14ad4b873df">6c713056fcaac0faac7fc14ad4b873df</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>.9csm.u?.=???..t?h???..??.......t%..???.....%%.??...
813963736DE075??833D??????000074??68??????00E8????000083C40485C074%CfFF15??????0083C4088B%f%fE8????00008
VID: D16B Trojan.Shylock</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>9</TD>
  <TD>11</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2932924b4c4c00284db0bd52c12498d9">2932924b4c4c00284db0bd52c12498d9</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>aryy.txt</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>ariettes</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>10</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>__vbaDerefAry1</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/2f4e31a6d07369dc4cfe23a8fc9f9d36">2f4e31a6d07369dc4cfe23a8fc9f9d36</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>__vbaDerefAry1</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>__vbaDerefAry1</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/fc2131185fd7f9bddd9240a6746fc326">fc2131185fd7f9bddd9240a6746fc326</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>__vbaDerefAry1</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>11</TD>
  <TD>25</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>Norton
4E6F72746F6E
ADD INFO: Norton reference
CLASSIFICATION: Can be used for mal purpose</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/6c713056fcaac0faac7fc14ad4b873df">6c713056fcaac0faac7fc14ad4b873df</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>.../.M.@.. .?...
C7A4AB2FA94D1340969720CC3FD40F85
ADD INFO: riid for TaskSchedule, could be used for exploit CVE-2010-3888
CLASSIFICATION: Can be used for mal purpose</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>12</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>G@@@T@@@h@@@</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>G@@@T@@@h@@@</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>G@@@T@@@h@@@</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>G@@@T@@@h@@@</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>13</TD>
  <TD>30</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>ppp&&'</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c05f582cc2e9f5bab040a019188fbe77">c05f582cc2e9f5bab040a019188fbe77</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>BBBppp</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>14</TD>
  <TD>10</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/e33d3d0c2d1556a3b9b2f6ccf21b30cc">e33d3d0c2d1556a3b9b2f6ccf21b30cc</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>< <$<(<,<0<4<8<<<@<D<H<V<^<f<t<x<</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/6c713056fcaac0faac7fc14ad4b873df">6c713056fcaac0faac7fc14ad4b873df</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>>(>,><>@>P>T>d>h>l>p>t>x>|></TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>15</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>symantec
73796D616E746563
ADD INFO: Symantec reference
CLASSIFICATION: Can be used for mal purpose</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/3cc9971f0b36eb7224e631983ab9fe04">3cc9971f0b36eb7224e631983ab9fe04</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>symantec
73796D616E746563
ADD INFO: Symantec reference
CLASSIFICATION: Can be used for mal purpose</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c0ba07c36a293bf1cd8ae4957553fb8f">c0ba07c36a293bf1cd8ae4957553fb8f</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>symantec
73796D616E746563
ADD INFO: Symantec reference
CLASSIFICATION: Can be used for mal purpose</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/8ed63ffcf9ae7d66f9420d2aa9ebd4b8">8ed63ffcf9ae7d66f9420d2aa9ebd4b8</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>symantec
73796D616E746563
ADD INFO: Symantec reference
CLASSIFICATION: Can be used for mal purpose</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>16</TD>
  <TD>24</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/23e1a5292cb85628092722ac94a95e3b">23e1a5292cb85628092722ac94a95e3b</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>....
C3FBB3C6
MEANING: name
TEXT REPRESENTATION: åç§°
ALPHABET: mingcheng
NOTES: seen in Explorer as "file name"
CHARACTER CODE: GB-2312 (Code Page 936)
LANGUAGE: Chinese
ATTACHMENT: 1</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/6c713056fcaac0faac7fc14ad4b873df">6c713056fcaac0faac7fc14ad4b873df</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>U.x.
55D678C7
MEANING: confirm, OK
TEXT REPRESENTATION: íì¸
ALPHABET: Hwagin
CHARACTER CODE: Unicode UTF-16 Little-endian (Low-High)
LANGUAGE: Korean</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Find</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>17</TD>
  <TD>18</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>__vbaDerefAry1</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/c4a7f6840ff9b4d7ea8779adb31a73f0">c4a7f6840ff9b4d7ea8779adb31a73f0</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>__vbaCyForNext</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
 <TR>
  <TD>18</TD>
  <TD>100</TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/ca019adaad22da805b5188dd4025f2ff">ca019adaad22da805b5188dd4025f2ff</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>3.02.0001</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="600">
 <TR>
  <TD><a href="http://rats.gist.symantec.com/rats/sample/traits/d079d52ef1fd7a57e472d57a09df7e89">d079d52ef1fd7a57e472d57a09df7e89</a></TD>
  <TD><TABLE cellpadding="4" style="border: 1px solid #FFFFFF; border-collapse: collapse;" border="1">
  <COL width="200">
  <COL width="400">
 <TR>
  <TD>trait</TD>
  <TD>3.02.0001</TD>
 </TR>
 <TR>
  <TD>trait_action</TD>
  <TD>Banjos</TD>
 </TR>
 <TR>
  <TD>trait_object</TD>
  <TD>String</TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE></TD>
 </TR>
</TABLE><br><br></br></br></body></html>